Description

PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface name length. Attackers can supply interface names of 74 bytes or more via the -i option to read beyond buffer boundaries, leaking stack memory to console output or writing it into persistent network configuration files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-08T12:17:00.300Z",
  "pubdate": "2026-09-08T12:17:00.300Z",
  "executiveSummary": "PX4 Autopilot versions through 1.17.0 are susceptible to a stack buffer over-read vulnerability located within the netman system command. This flaw arises from insufficient bounds checking when processing user-supplied interface names via the -i command-line option.\nThe vulnerability allows an attacker to trigger an out-of-bounds read by providing an interface name string exceeding 74 bytes. Successful exploitation results in the leakage of adjacent stack memory contents, which may be directed to the console output or serialized into persistent network configuration files.\nThis exposure represents a significant security risk, as sensitive stack data, potentially including pointers, return addresses, or cryptographic material, could be exfiltrated. The impact is escalated by the ability to move leaked memory into persistent storage, facilitating potential long-term data exfiltration or memory disclosure. Exploitation requires the ability to interact with the system command interface provided by the autopilot firmware, presenting a moderate barrier to entry depending on the specific device configuration and interface exposure.",
  "technicalDetails": "The vulnerability resides in the netman command-line utility used by PX4 Autopilot to manage network interfaces. The root cause is a classic lack of input validation regarding the length of the string argument passed to the -i parameter. The destination buffer on the stack, intended to store the interface identifier, is insufficiently sized to accommodate strings of 74 bytes or greater.\nWhen an attacker invokes the netman command with a malicious -i argument, the system copies the user-supplied string into the fixed-size stack buffer without verifying that the length of the source data fits within the allocated memory boundaries. This triggers a stack buffer over-read, where the internal copy routine reads past the intended buffer allocation.\nThe attack flow follows these steps: First, the attacker initiates a call to the netman binary, providing a crafted input string for the -i flag that exceeds the 74-byte threshold. Second, the application attempts to process this interface name, leading to the read of adjacent memory locations on the stack. Third, the resulting over-read memory content is processed by the application's logging or configuration write functions. Finally, the leaked data is either echoed back to the user via standard console output or written into persistent configuration files stored on the device's storage medium.\nThis vulnerability is critical because it bypasses memory safety boundaries, exposing the internal state of the stack. Depending on what resides adjacent to the buffer at runtime, an attacker may extract sensitive information such as function pointers (useful for bypassing ASLR/KASLR in further exploit chains), sensitive system state information, or transient user data. Furthermore, by forcing the system to write this leaked memory to a persistent configuration file, the attacker gains the ability to retrieve the exfiltrated memory at their convenience, even if the initial session is terminated. This behavior transforms a transient memory error into a persistent information disclosure capability, which is particularly concerning in autonomous systems where configuration files might be accessible via telemetry or physical access."
}